feat(release): emit golden-path validation JSON

[tang-vu]

Summary

• add validate-golden-paths.py --json with source, scenario count, and structured issues
• return valid JSON for success, missing files, invalid JSON, and aggregated contract failures
• preserve the existing human output and exit code 1 on invalid contracts
• keep the default canonical contract path optional

Why this matters

Golden-path validation protects the four documented installation routes before release. CI and release dashboards can now attach exact JSON paths and messages to a candidate artifact instead of parsing prose, including early file/JSON failures.

Overlap check

Searched open and closed PRs for golden path validation json and PRs referencing ods/scripts/validate-golden-paths.py. Open PRs #3409/#2742 harden file decoding and #2536 confines contract paths; none adds structured output. The four-scenario validation rules remain unchanged.

Test plan

• bash ods/tests/test-golden-paths.sh
• python -m py_compile ods/scripts/validate-golden-paths.py
• git diff --check -- ods/scripts/validate-golden-paths.py ods/tests/test-golden-paths.sh

Tradeoffs and rollback

Issue objects expose JSON path and message without adding a schema dependency. The human format remains default, and removing --json requires no data migration or caller rollback.

Generated with Codex

Batch compatibility

• Independently mergeable; tested combined in order feat(mode): emit routing status as JSON #3657 → feat(bootstrap): list hosted verification endpoints #3666.
• Base: upstream/main@6ff9b4fc; synthetic integration head: e45e2647.
• All focused public-boundary suites, the canonical generated-config JSON scan (12 surfaces), make lint, and git diff --check upstream/main...HEAD passed.
• tests/test-installer-context-parity.sh still fails at Hermes template bounds each model turn; the identical failure was reproduced on the exact upstream base, so it is not introduced by this batch.
• No live Docker mutation, model activation, migration, hosted deployment, or hardware validation is claimed.